tempoxyz/tempo v1.1.0

v1.1.0 - T1 (Bach) Testnet Network Upgrade

on GitHub

The Bach (T1) network upgrade implements three major TIPs:

• TIP-1000: State Creation Cost Increase
• TIP-1009: Expiring Nonces
• TIP-1010: Mainnet Gas Parameters

This release includes breaking changes on the CLI, precompile interface, please read the release notes carefully.

Network Upgrade Changes

TIP-1000: State Creation Cost Increase

Tempo's high throughput makes it vulnerable to state growth attacks where adversaries could create terabytes of permanent state at low cost. TIP-1000 increases state creation costs by 12.5x, making such attacks economically infeasible (~$50M to create 1TB of state). Transfers to new addresses now cost ~300k gas (was ~70k), and contract deployments cost 5-10x more.

TIP-1009: Expiring Nonces

Traditional sequential nonces create friction for gasless transactions and parallel submission. If transaction N fails, all subsequent transactions are blocked. Additionally, 2D nonces (nonce keys) can lead to permanent state bloat since unused nonce keys are stored forever. TIP-1009 introduces expiring nonces: Transactions specify a validBefore timestamp (max 30s in future) instead of a sequential nonce. A fixed-size circular buffer (300k entries) automatically evicts expired entries, preventing state growth. This enables relayers to submit multiple transactions in parallel without complex nonce management, while eliminating the state bloat attack vector.

(#2121): Time-bounded replay protection using transaction hashes. Transactions use nonceKey = uint256.max with validBefore timestamp (max 30s in future). Enables gasless/meta-transactions and parallel submission.

TIP-1010: Mainnet Gas Parameters

TIP-1010 calibrates Tempo's mainnet gas parameters, balancing high throughput with sustainable fee levels. The base fee increase to 20 gwei maintains the target of ~0.1 cent per TIP-20 transfer while providing better spam protection. The 500M block gas limit ensures sufficient capacity for payment transactions.

(#2194):

New Features

• Unified Telemetry Configuration: New --telemetry-url <URL> flag configures metrics and logs export in a single option. Pushes both reth and consensus metrics with a consensus_id label for node identification. We ask all validators to configure the --telemetry-url so we can support troubleshooting.
• Separate Consensus Storage Directory: New --consensus.datadir <PATH> flag allows validators to store consensus data on a separate volume (e.g., AWS EBS) while keeping execution state on high-performance local disks. Migrate by copying <datadir>/consensus to the new location.
• Validator Info CLI Command: New consensus validators-info subcommand
• Validator Health Dashboard: New Grafana dashboard for validator monitoring
• Fee Payer Signature Support: TempoTransactionRequest supports fee_payer_signature
• Expiring Nonce Setters: Added valid_before/valid_after setters to TempoTransactionRequest

Breaking Changes

CLI Changes

• Testnet Chain Name: Testnet nodes must now use --chain moderato. The previous andantino chainspec has been removed. Update node startup scripts and systemd services accordingly (#1876, introduced in v1.0.0)

• CLI Force Flag: --delete-signing-share now requires --force flag to prevent accidental deletion of validator signing keys. Update any automation scripts that manage validator key lifecycle (#2215).

Precompile Interface Changes

• Precompile Revert Behavior: Precompiles now revert with a standard error (instead of returning a precompile-specific error) when calldata is less than 4 bytes (missing function selector). This aligns precompile behavior with regular Solidity contracts. Update try/catch blocks and test assertions that expected the old error type (#2083).

• ValidatorConfig Signature Change: changeValidatorStatus(address, bool) now takes a uint64 index instead of address. This prevents front-running attacks where a malicious validator could rotate their address before deactivation. Callers must now look up the validator's index in the validator array (#2188).

Access Key / Keychain Changes

• Keychain Signature Validation: Signature type (secp256k1, secp256r1, etc.) must now match the key_type stored when the key was authorized. This closes a security gap where a key authorized for one curve could potentially be used with a different signature scheme. Transactions with mismatched types are rejected at the mempool level (#2178).

Gas Economics (T1 Network Upgrade)

• 2D Nonce Key Gas (TIP-1000): Accessing an existing 2D nonce key now costs 5,000 gas (was 0). Update gas estimates for transactions using 2D nonces (#2362).

• Developer Action Required: The gas cost changes in TIP-1000 and TIP-1010 (see tables above) require updating gas_limit values in your configuration, estimateGas() calls, and any hardcoded gasPrice or maxFeePerGas values in scripts and transaction builders.

Security Fixes

• Signature Type Validation: Verifies signature type matches key_type, closing a security gap where authorized keys could potentially be used with a different signature scheme.
• ValidatorConfig Front-running Fix: Uses validator index instead of address in changeValidatorStatus to prevent malicious validators from evading deactivation by rotating addresses.
• Transaction Pool DoS Hardening: Multiple fixes to prevent eviction-based DoS attacks (#2352, #2327, #2216, #2242, #2183, #2167)
• Checkpoint Revert on Key Authorization OOG: Properly reverts state on out-of-gas during key authorization.
• Reject Expired Access Keys: Mempool rejects transactions with expired access keys.
• Reject Paused TIP20 Tokens: Prevents fee validation bypass using paused tokens.

Full Changelog: v1.0.2...v1.1.0